Gen:Trojan.Heur.RP.@FW@aadPfKpj (B) (Emsisoft), Gen:Trojan.Heur.RP.@FW@aadPfKpj (AdAware), Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 67f845b6404d088455a9baa5c2d9ec9e
SHA1: 9169a915bd58533472233cdcb3993dcfb61dc54f
SHA256: ec7db15e88545465e16da54978dae8257fe8f191794ae3ee9f2d45100726dc05
SSDeep: 98304:PmXu3VSiI1ssZu5zujFdBvgggd5ZPlbRXjnbek8:OeF3WDBvYd5RFRXTb6
Size: 5017088 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PolyEnE001byLennartHedlund, UPolyXv05_v6
Company: no certificate found
Created at: 2017-01-03 15:06:51
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
winnet.exe:1248
Intel.exe:1900
The Trojan injects its code into the following process(es):
%original file name%.exe:2956
Reality.log:1796
pack11.exe:3608
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:2956 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Intel.sys (20 bytes)
C:\Windows\winnet.dll (124 bytes)
C:\Windows\winnet.exe (70 bytes)
C:\Windows\System32\config\SYSTEM.LOG1 (7918 bytes)
C:\$Directory (2304 bytes)
C:\Windows\System32\config\SYSTEM (5748 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Intel.exe (127 bytes)
The process pack11.exe:3608 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
The process winnet.exe:1248 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Windows\winnet.dll (126 bytes)
C:\Windows\LSP.dll (88 bytes)
The process Intel.exe:1900 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pack11.exe (7427 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\pack11[1].exe (6835 bytes)
Registry activity
The process %original file name%.exe:2956 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\System\CurrentControlSet\services\Intel\Instances\Intel Instance]
"Flags" = "0"
[HKLM\System\CurrentControlSet\services\Intel\Instances]
"DefaultInstance" = "Intel Instance"
[HKLM\System\CurrentControlSet\services\Intel\Instances\Intel Instance]
"Altitude" = "370033"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
The process winnet.exe:1248 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000022]
"ProtocolName" = "LR_LSP"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60101"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-100"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000024]
"ProtocolName" = "LR_LSP"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000024]
"PackedCatalogItem" = "43 3A 5C 57 69 6E 64 6F 77 73 5C 4C 53 50 2E 64"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-101"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Next_Catalog_Entry_ID" = "1124"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-103"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{BDC8D276-A5D8-4E4C-8EB2-2752A8E55337}] SEQPACKET 2"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000023]
"ProtocolName" = "LR_LSP"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Num_Catalog_Entries" = "21"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60100"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-102"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{03967CDD-F8BD-4AC9-8369-0D2BD8F246F5}] DATAGRAM 1"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"PackedCatalogItem" = "43 3A 5C 57 69 6E 64 6F 77 73 5C 4C 53 50 2E 64"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{03967CDD-F8BD-4AC9-8369-0D2BD8F246F5}] SEQPACKET 1"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FB1DE278-988C-428A-AF16-245107A1AA49}] DATAGRAM 3"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip_{03967CDD-F8BD-4AC9-8369-0D2BD8F246F5}] DATAGRAM 0"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"ProtocolName" = "LR_LSP"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"ProtocolName" = "VMCI sockets STREAM"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Serial_Access_Num" = "43"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"ProtocolName" = "VMCI sockets DGRAM"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{BDC8D276-A5D8-4E4C-8EB2-2752A8E55337}] DATAGRAM 2"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000023]
"PackedCatalogItem" = "43 3A 5C 57 69 6E 64 6F 77 73 5C 4C 53 50 2E 64"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60102"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FB1DE278-988C-428A-AF16-245107A1AA49}] SEQPACKET 3"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip_{03967CDD-F8BD-4AC9-8369-0D2BD8F246F5}] SEQPACKET 0"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60101"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000022]
"PackedCatalogItem" = "43 3A 5C 57 69 6E 64 6F 77 73 5C 4C 53 50 2E 64"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60100"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60102"
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"
The Trojan deletes the following registry key(s):
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000024]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000023]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000022]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
[HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\0000002C]
[HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\0000002B]
[HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\0000002A]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
The process Intel.exe:1900 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Tracing\Intel_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\Intel_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\Intel_RASMANCS]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\Intel_RASAPI32]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Tracing\Intel_RASMANCS]
"FileDirectory" = "%windir%\tracing"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\Intel_RASMANCS]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Tracing\Intel_RASAPI32]
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Tracing\Intel_RASMANCS]
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Tracing\Intel_RASAPI32]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\Intel_RASMANCS]
"EnableConsoleTracing" = "0"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"INTEL" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Intel.exe"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"
Dropped PE files
| MD5 | File path |
|---|---|
| 03743259b426d308769257cb9ed9e93f | c:\Windows\LSP.dll |
| c0cef56783f492e1e9f29a6f15848b74 | c:\Windows\winnet.dll |
| 7c184ba0b79448b278caef6895ac6cf4 | c:\Windows\winnet.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
Using the driver "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Intel.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.
Using the driver "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Intel.sys" the Trojan controls operations with a system registry by installing the registry notifier.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
winnet.exe:1248
Intel.exe:1900 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Intel.sys (20 bytes)
C:\Windows\winnet.dll (124 bytes)
C:\Windows\winnet.exe (70 bytes)
C:\Windows\System32\config\SYSTEM.LOG1 (7918 bytes)
C:\$Directory (2304 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Intel.exe (127 bytes)
C:\Windows\LSP.dll (88 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pack11.exe (7427 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\pack11[1].exe (6835 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"INTEL" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Intel.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 34759 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .rdata | 40960 | 10454 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .data | 53248 | 12268 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .vmp0 | 65536 | 5256863 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .vmp1 | 5324800 | 4729192 | 4729344 | 5.38718 | 4fb51347839a3806d70ae489fa68c00b |
| .reloc | 10055680 | 244 | 512 | 2.07686 | 2f5a7d0f98be02539885a12becc5f6db |
| .rsrc | 10059776 | 286205 | 286208 | 1.886 | 5365c5f5ef46ff9112f3b8db23e27491 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://www.dresou.net/pack11.exe | 47.90.18.203 |
| www.wdcrf.net | 43.241.50.128 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /pack11.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.dresou.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 42496
Content-Type: application/octet-stream
Last-Modified: Tue, 06 Dec 2016 06:37:42 GMT
Accept-Ranges: bytes
ETag: "07fcf3e8b4fd21:6ab"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Wed, 18 Jan 2017 05:33:58 GMT
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................)...............(.......................-.....................Rich....................PE..L...N..W............................p:.......@....@..........................P............@..................................B.......@.......................C......................................4<..H...........................................UPX0....................................UPX1................................@....rsrc........@......................@......................................................................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....r&.\...1....o.......&..{....U.....SV.5....... .3.W..3..]..........|#.F....@.....4.......m{..Q..U....Hu..'..~.............E.......t.....................I._..^..[..]..........o...Ut-...............HTTP/1.1 200 OK..Content-Length: 42496..Content-Type: application/octet-stream..Last-Modified: Tue, 06 Dec 2016 06:37:42 GMT..Accept-Ranges: bytes..ETag: "07fcf3e8b4fd21:6ab"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Wed, 18 Jan 2017 05:33:58 GMT..MZ......................@...............................................!..
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_2956:
.text
.text
`.rdata
`.rdata
@.data
@.data
.vmp0
.vmp0
.vmp1
.vmp1
.reloc
.reloc
@.rsrc
@.rsrc
GetProcessWindowStation
GetProcessWindowStation
Reality.log
Reality.log
D:\chengzhen\DNF\StartGame\Release\StartGame.pdb
D:\chengzhen\DNF\StartGame\Release\StartGame.pdb
C:\OneRun.txt
C:\OneRun.txt
360tcpview
360tcpview
365tcpview
365tcpview
cports
cports
tcpview
tcpview
c:\%original file name%.exe
c:\%original file name%.exe
zr_]UbN
zr_]UbN
.xV``
.xV``
.YB}n=
.YB}n=
.uBs{(JBq
.uBs{(JBq
&.uFi
&.uFi
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
USER32.DLL
USER32.DLL
operator
operator
activation.php?code=
activation.php?code=
deactivation.php?hash=
deactivation.php?hash=
y2.eu:
y2.eu:
.?AVIUrlBuilderSource@@
.?AVIUrlBuilderSource@@
` Bb]%X
` Bb]%X
.Ujb!7l$_s
.Ujb!7l$_s
.jbBA
.jbBA
uDp'\T?UT6
uDp'\T?UT6
^U.Qf
^U.Qf
/.XZViC
/.XZViC
"%1zqQ.Rog$
"%1zqQ.Rog$
YQ.EM6
YQ.EM6
$[.zZ9)~M
$[.zZ9)~M
-%fT\;Q
-%fT\;Q
L.rg-
L.rg-
%F/.0
%F/.0
(nF%sr5-
(nF%sr5-
Y
Y
.ToDLCF
.ToDLCF
Q.EMN
Q.EMN
-r.arz%l\
-r.arz%l\
".qZE=
".qZE=
_DsSH[Tq
_DsSH[Tq
M:.yjJu|h#
M:.yjJu|h#
\TCpAIN
\TCpAIN
v.uYQ2Ls
v.uYQ2Ls
VeRr%3x
VeRr%3x
.utDd'3|
.utDd'3|
m&y.Wh{(
m&y.Wh{(
7h}%f
7h}%f
".qPd
".qPd
.Wh2N
.Wh2N
xX_C~^%xtC
xX_C~^%xtC
Ni%f*
Ni%f*
.uJjQ?p8_
.uJjQ?p8_
.so$:evV=
.so$:evV=
&.yxHh7
&.yxHh7
xOKCXQai.EMf
xOKCXQai.EMf
MfY2M2.af
MfY2M2.af
Ee.cS[4'
Ee.cS[4'
r.uYQ>
r.uYQ>
$kdDw#hp .hJ
$kdDw#hp .hJ
5va.Ire&YF
5va.Ire&YF
).yb-~
).yb-~
5NCsSH
5NCsSH
-b}u6
-b}u6
&.YqLl
&.YqLl
]:.aq2
]:.aq2
".yU~F
".yU~F
6 ]em.Poh
6 ]em.Poh
kc(>m&.UT
kc(>m&.UT
n.yU]"
n.yU]"
.ek4'/`x
.ek4'/`x
.YJIZ-
.YJIZ-
.qbj)
.qbj)
c.zrA
c.zrA
V^%dT\C
V^%dT\C
!~Q.IreFg(
!~Q.IreFg(
0OZjb=
0OZjb=
(c.zrE
(c.zrE
>U!-b}6u
>U!-b}6u
(oe2.yTp?
(oe2.yTp?
}.yb-{
}.yb-{
^.px3
^.px3
_@.qe
_@.qe
'gi.de
'gi.de
z-b}u
z-b}u
Mf:m%fz%
Mf:m%fz%
i.EMV
i.EMV
e.EeF
e.EeF
wPAE%uz
wPAE%uz
V^Ã
V^Ã
HkXPCNZ5&.UTdl
HkXPCNZ5&.UTdl
n%Ux
n%Ux
Jm%f|
Jm%f|
8"th/%fn
8"th/%fn
&.yxH@_3Lck
&.yxH@_3Lck
C8 s)z.yi6"e
C8 s)z.yi6"e
`em.DE'
`em.DE'
X !j~_:
X !j~_:
J%Dpx
J%Dpx
L^.px
L^.px
.MEnc7?|
.MEnc7?|
.AVme&k?
.AVme&k?
via:.yoD
via:.yoD
dt#4
dt#4
.Yn_W0
.Yn_W0
4[.zr
4[.zr
-BP2}6
-BP2}6
V^Ã8O>2
V^Ã8O>2
.zZE
.zZE
0/'l=ia.Ee*`
0/'l=ia.Ee*`
.yFf=`?
.yFf=`?
M2.aL@W
M2.aL@W
%fOk,WX
%fOk,WX
-Mm}u
-Mm}u
)r-%f
)r-%f
Rr_]Ufk?
Rr_]Ufk?
]2.qa"
]2.qa"
.yb1bA
.yb1bA
uQ.IBUB]V
uQ.IBUB]V
`a%fh3_-
`a%fh3_-
%7U}u2
%7U}u2
QY.Ee6
QY.Ee6
|?p{(M:.eb
|?p{(M:.eb
".qPL3l
".qPL3l
/.XT?
/.XT?
W8.anNa
W8.anNa
dUI6i.aB
dUI6i.aB
-2}JjE-^qQZ
-2}JjE-^qQZ
n^V-%fp,
n^V-%fp,
rs/.yM
rs/.yM
.meF$
.meF$
{.IY(ssp
{.IY(ssp
.iw(W_0;3PCL
.iw(W_0;3PCL
f!V^%dT\W
f!V^%dT\W
ck4g(s0U.aF
ck4g(s0U.aF
)gQ^TcPp f2:Q
)gQ^TcPp f2:Q
}.yb-V=
}.yb-V=
&.iw(v
&.iw(v
%fyq&Y
%fyq&Y
9RM6a.Ify
9RM6a.Ify
.iPdC
.iPdC
.zr-ZR]
.zr-ZR]
.YBYbU
.YBYbU
&.im%
&.im%
Kd_Lq.OTo$
Kd_Lq.OTo$
}.un1z=
}.un1z=
.ie_Z
.ie_Z
&.YDHoWa
&.YDHoWa
m&.wJ
m&.wJ
.XT7?P
.XT7?P
%FY:s
%FY:s
}.qy&4gZ
}.qy&4gZ
vj=w
vj=w
P<.leti_->
P<.leti_->
C".qPd7
C".qPd7
S@.iq
S@.iq
&e.EM>s'
&e.EM>s'
.eixn
.eixn
~„c_
~„c_
u.ybY
u.ybY
bZ5Oy&b%dH{m
bZ5Oy&b%dH{m
e.anf9x,$
e.anf9x,$
UT".iRAL
UT".iRAL
kGp/.XT[
kGp/.XT[
h`7r&.ir
h`7r&.ir
j$=z.ue:
j$=z.ue:
.iPdO
.iPdO
.iNEj)
.iNEj)
V^%dT\ @`G
V^%dT\ @`G
S-j}]2wGg,
S-j}]2wGg,
CZ.pPS/
CZ.pPS/
Z5%fH
Z5%fH
.iD`W
.iD`W
.evV=
.evV=
.TS\E
.TS\E
uAz.qbjU
uAz.qbjU
(m4.TA
(m4.TA
".ab9)f
".ab9)f
.uFukjg
.uFukjg
071=^6
071=^6
QT".qe
QT".qe
nfÃ
nfÃ
FfÃ
FfÃ
2.eA{'nS
2.eA{'nS
=r.iPdC
=r.iPdC
.Yj)R5
.Yj)R5
cU.Ee
cU.Ee
5z.qa
5z.qa
%DL;gZ
%DL;gZ
e2.qa"
e2.qa"
7l?h[Hm.aN
7l?h[Hm.aN
c'TCpx
c'TCpx
NJ= \Ÿ
NJ= \Ÿ
kKpy-%f
kKpy-%f
}Y.aR
}Y.aR
&.iw
&.iw
&.uJjA
&.uJjA
%fqQf
%fqQf
kV|9.tPG
kV|9.tPG
Wd
Wd
Q:d~ykc@.YfFU}
Q:d~ykc@.YfFU}
pP7r&.iq
pP7r&.iq
sSHW
sSHW
S[0y-%f[GD
S[0y-%f[GD
/\-yY.de
/\-yY.de
"U].UdDG
"U].UdDG
%F}uB
%F}uB
-ytu}
-ytu}
'|sSHr%
'|sSHr%
9b".aJIZE~
9b".aJIZE~
d.NeRr9
d.NeRr9
aEr.uc4
aEr.uc4
H^.px
H^.px
^5-j}
^5-j}
"U.bQ
"U.bQ
}V^%dTtC
}V^%dTtC
.Tp';
.Tp';
>6UbSsH
>6UbSsH
V-&.irz-"u
V-&.irz-"u
.IqC~
.IqC~
.ab9p@H?."}
.ab9p@H?."}
-G.RU
-G.RU
}.ybM
}.ybM
BJU\lLC".qy*
BJU\lLC".qy*
}.qy&4gNjE
}.qy&4gNjE
g~v%dT
g~v%dT
.qD`/?
.qD`/?
q.uTK
q.uTK
U:v.Mai
U:v.Mai
i2.eu>
i2.eu>
!;m.GKR
!;m.GKR
h.jls
h.jls
.hsPb3
.hsPb3
.hsPf5a
.hsPf5a
.hC:f
.hC:f
_qf%xrb
_qf%xrb
|e.eZ*
|e.eZ*
Js%sX
Js%sX
.odTa
.odTa
.HA;
.HA;
`h%fp
`h%fp
.oVSa
.oVSa
d1.Zf.
d1.Zf.
nB.MCU
nB.MCU
.UC\&
.UC\&
&.Zf*L
&.Zf*L
|e.uE
|e.uE
%SqM:2
%SqM:2
.VRKHV=
.VRKHV=
V|"'mOusSh
V|"'mOusSh
4 `h%fp
4 `h%fp
|^.dd
|^.dd
.Nn59
.Nn59
{.UFt
{.UFt
-l%d)
-l%d)
.IC\&
.IC\&
.zq)y6
.zq)y6
B;3%x
B;3%x
bBE.rcD
bBE.rcD
.FM\m
.FM\m
.g(%d,dc
.g(%d,dc
s9G.lB,
s9G.lB,
uudPC
uudPC
Kqñ*
Kqñ*
>-%x(
>-%x(
.gJw/
.gJw/
\.vN%
\.vN%
.YRKBf
.YRKBf
H%U|[
H%U|[
H%Us[
H%Us[
).JS3
).JS3
'%X~&
'%X~&
/.DTa
/.DTa
8U.VBF
8U.VBF
z31 e.VB
z31 e.VB
L.za=
L.za=
.Aye?$
.Aye?$
.DFIM
.DFIM
}-Sh}m
}-Sh}m
JFtp
JFtp
$]%D#X
$]%D#X
|e.VR
|e.VR
!C.YB
!C.YB
dR.XE
dR.XE
I!K.bB
I!K.bB
JP%d,
JP%d,
Q%c:x
Q%c:x
;lz%u
;lz%u
vrý
vrý
trK%U
trK%U
ryf=.wKH?
ryf=.wKH?
s-E}.
s-E}.
nd.va
nd.va
5<.tj>
5<.tj>
Q/}
Q/}
.U%D$9
.U%D$9
.Zl@ h;
.Zl@ h;
BZ.ti
BZ.ti
DD.ZZ
DD.ZZ
pj.YK&
pj.YK&
*%sVO6
*%sVO6
J.Bx=
J.Bx=
`%s},
`%s},
.GDZe
.GDZe
.Bg=I
.Bg=I
3@F%x
3@F%x
F.uljH
F.uljH
w.LXVL
w.LXVL
oC%d@
oC%d@
).cuP
).cuP
3.vUu
3.vUu
>Z.Dq
>Z.Dq
.MDRw
.MDRw
{?a%u_
{?a%u_
K\X.emh
K\X.emh
2^:_56!5
2^:_56!5
%X#X2Vy8h
%X#X2Vy8h
yFTP
yFTP
/.Lec
/.Lec
wW%sw8;x$
wW%sw8;x$
.lcHp
.lcHp
X\%dZ
X\%dZ
t%fnL
t%fnL
dessH
dessH
(1.Wl:
(1.Wl:
`.pLv
`.pLv
}gq%Xp
}gq%Xp
h\1(.zU
h\1(.zU
I`.PkG
I`.PkG
%X@X!(j
%X@X!(j
%u6mO.
%u6mO.
H\.kH@
H\.kH@
TH 9EXe
TH 9EXe
.MvV`
.MvV`
UXY.uE
UXY.uE
.ly1z
.ly1z
%c!OA
%c!OA
JExE
JExE
.GXoj
.GXoj
Dg.pL
Dg.pL
x_.Xw
x_.Xw
.Cxs#
.Cxs#
c4.XC
c4.XC
.UE%3
.UE%3
H.Ib*OE
H.Ib*OE
s.Qa4KG
s.Qa4KG
*0%UtR
*0%UtR
d\).zO
d\).zO
@%fpL1
@%fpL1
F24
F24
.SLOL
.SLOL
%Sk%6
%Sk%6
%4.d{
%4.d{
Cz:%C
Cz:%C
*M.QS~
*M.QS~
%Fu^gw
%Fu^gw
%XSP}
%XSP}
>ge.DM
>ge.DM
x*O2%U
x*O2%U
-3}xH
-3}xH
u7H%S
u7H%S
c%x0.
c%x0.
~d.hz
~d.hz
RL
RL
G,Y%U
G,Y%U
M.hzc
M.hzc
.CL",
.CL",
.Any1V
.Any1V
bB$,F
bB$,F
.DBE:
.DBE:
%u@-N
%u@-N
fJi.FH
fJi.FH
.Hy6e
.Hy6e
8Tt%u)
8Tt%u)
.MU_(
.MU_(
[{%fH#d
[{%fH#d
r4)%UG
r4)%UG
.lD?g3w
.lD?g3w
#(.HS
#(.HS
tweb
tweb
.mQH5
.mQH5
.yi,Q
.yi,Q
U%c*P
U%c*P
Z/.kY]
Z/.kY]
wBZ.cw
wBZ.cw
K%U=-
K%U=-
.BU{,i
.BU{,i
a=%do5
a=%do5
Wpmsg
Wpmsg
(.une`
(.une`
H%U-=
H%U-=
wBZ.cs
wBZ.cs
6J<.gwy>
6J<.gwy>
wBZ.wJ
wBZ.wJ
.UMTa
.UMTa
UgO.eQ
UgO.eQ
%Dk*qH
%Dk*qH
1%XWw
1%XWw
99.%F
99.%F
.uk@B
.uk@B
AjT%s
AjT%s
5>%F"2
5>%F"2
ftPy
ftPy
=X-Q}
=X-Q}
eG.uN
eG.uN
.QU=~
.QU=~
W`~%xx
W`~%xx
ÞJ6
ÞJ6
4n!.kT "
4n!.kT "
T%S0F?V
T%S0F?V
pI%SmJ*^
pI%SmJ*^
%Ubq%
%Ubq%
X%Djy[
X%Djy[
=.ptS
=.ptS
#&.ns
#&.ns
.XMTa
.XMTa
.Nr_d
.Nr_d
o.PVX
o.PVX
,p3%x
,p3%x
d%s15(
d%s15(
.zVZ?
.zVZ?
G.dV'
G.dV'
QweB0
QweB0
d=cüi
d=cüi
g|%Cv
g|%Cv
=.aG)c
=.aG)c
iSTZ%u
iSTZ%u
8 IK3%d
8 IK3%d
#%fW[iG
#%fW[iG
T{%S8
T{%S8
M:.hP
M:.hP
W$.wI/i
W$.wI/i
AA.pV
AA.pV
jZ.znI
jZ.znI
%D-m=
%D-m=
Zg-A}
Zg-A}
}*r%d/
}*r%d/
.>t%f(
.>t%f(
d.ck3p
d.ck3p
.Ej#6`
.Ej#6`
nob.wX`#j
nob.wX`#j
%a.dp
%a.dp
.qI-K
.qI-K
? .RMTaG
? .RMTaG
"Tdb.wY
"Tdb.wY
.RMTa/{U
.RMTa/{U
hSZ.eG
hSZ.eG
5"C
5"C
5-w6}
5-w6}
,9>%Fr1
,9>%Fr1
M?;1.Bt
M?;1.Bt
.Pak!
.Pak!
q.xC,
q.xC,
:7:{&.UTdDG
:7:{&.UTdDG
5Ni.aF
5Ni.aF
.fn%WhdK
.fn%WhdK
b..SY
b..SY
X|%%s
X|%%s
.mPobz
.mPobz
JP%s7
JP%s7
W:\(Q%
W:\(Q%
!-,%S
!-,%S
u.yb]
u.yb]
%f^V9N
%f^V9N
MZ .XT7
MZ .XT7
I:.iy"
I:.iy"
ro7.VPF
ro7.VPF
U.QJu
U.QJu
r.Mai>:9
r.Mai>:9
9z.af
9z.af
zn%3X
zn%3X
&.yb]
&.yb]
wU].QZ
wU].QZ
1.rR4S
1.rR4S
0?k.iw
0?k.iw
i.fFI
i.fFI
ExitWindowsEx
ExitWindowsEx
5r.qa
5r.qa
.bfFa
.bfFa
*.me.
*.me.
c{/&%fx
c{/&%fx
`B.vc
`B.vc
%um|T
%um|T
v$%S_T
v$%S_T
[,j"&.qX
[,j"&.qX
KERNEL32.dll
KERNEL32.dll
.ut`?w
.ut`?w
Dw%ft
Dw%ft
USER32.dll
USER32.dll
7}7
7}7
6*7074787
6*7074787